How to Protect Your Pre-1997 IP Address

If your company obtained its IP address space before 1997, you have probably received several letters from the American Registry for Internet Numbers Ltd. (ARIN) encouraging you to enter into a contractual agreement to protect the IP address. But should you sign it?

ARIN's contract is called the Legacy Registration Services Agreement (Legacy RSA). It proposes to give companies contractual guarantees, including grandfathering of certain protected rights; continued use -- at no extra charge, at least for now -- of IP address services like "in-addr" and "whois" listings; reduced annual fees compared with those of ARIN's regular IP address holders; and future fee waivers, in exchange for returning unused IP address space.

But be careful -- there are several issues you should consider before signing up for this.

The information and advice in this piece are based on my experience advising legacy address holders in connection with their participation in the Legacy RSA program. I've been working with legacy holders since the beginning of the program in 2007, and my representation has included leading negotiations with ARIN on behalf of clients. As part of this effort, I've also had informal consultations with ARIN's lead counsel and its directory of registry services.

Some history

Since Dec. 22, 1997, ARIN has been the authorized administrator of IPv4 address allocations and services in North America. ARIN is one of five regional Internet address registries, all operating under the authority of ICANN. ARIN obtained this authorization through a delegation from InterNIC, which previously handled the assignment and administration of domain names and IP addresses. (InterNIC itself was organized in 1993 by the National Science Foundation and Network Solutions Inc., a private company awarded the government contract to provide IP address services.)

Before 1993, IP addresses were assigned through the Internet Assigned Numbers Authority (IANA).

Under the rules of InterNIC and IANA, Internet service providers and certain end users were allocated or assigned IP address blocks directly, subject only to industry-accepted best practices and Internet community standards. There were no contractual obligations between the registries and these legacy IP address holders.

By the time ARIN appeared on the scene, even as early as 1997, there was concern within the Internet community about possible IPv4 address space exhaustion. To protect against that, ARIN adopted policies designed to discourage IP address hoarding and to promote space reuse. Under ARIN's policy, for example, ISPs that obtain direct allocations of IPv4 addresses require each of their downstream customers to show that it has used at least 80% of its previously assigned IPv4 addresses before receiving any new ones.

Similarly, end users who want to receive additional assignments of IPv4 network space from ARIN must demonstrate that they are using at least 80% of their current addresses, will use at least 25% of the requested addresses immediately and will use 50% of the new addresses within one year of the request, based on reasonable and documented network growth projections.

Failure to comply with ARIN's resource conservation policies could result in the revocation of some of an organization's IPv4 addresses.

The legacy registration program

Registrants that obtained IP addresses directly from ARIN after 1997 entered into service agreements that fall under ARIN's jurisdiction, and are therefore subject to ARIN's resource utilization policies. But it is unclear whether IP address registrations of legacy IP address holders -- those that happened before 1997 -- were ever formally transferred to ARIN. ARIN has never claimed that it has control over these legacy IP addresses, but at the same time, it has never conceded that it lacks the authority either.

In an effort to harmonize the policies across all IP address allocations -- legacy and non-legacy -- and to cement ARIN's jurisdiction over the legacy address holders, ARIN launched its Legacy RSA program in late 2007. The deadline for signing up for this program is Dec. 31, 2011 -- recently extended by ARIN for an additional year. The costs are $100 per year through 2013, with potential increases after that, but by no more than $25 per year.

To participate, a legacy IP address holder must submit an application to ARIN. Participation in the program is voluntary and is limited to the original registrants and subsequent transferees that can prove -- with supporting documentation -- to ARIN that their legacy IP addresses were obtained lawfully from an original registrant.

Finding any documentation about original address registrations is difficult for many legacy registrants. If companies address the documentation issue with ARIN in advance, gaps in their registration records may not necessarily prevent them from participating in the Legacy RSA program. But ARIN does not state what "supporting documentation" means.

After ARIN approves the application, the legacy address holder and ARIN may then enter into the Legacy RSA.